feat: add Jinja2 template safety utilities

[kocaemre]

Summary

• Add ENABLE_JINJA2_SECURITY (default True) to control template-injection safeguards.
• Add template_mcp_server.utils.jinja2_security helpers:
  • escape_jinja2_delimiters(text)
  • validate_user_query_for_jinja2(query)
  • get_secure_jinja2_env() with autoescape=True by default
• Log blocked delimiter-based injection attempts at warning level.
• Document the feature flag in .env.example and README.md.

Why

This provides the Jinja2 safety utility layer requested in #50 for template code that needs to handle user-controlled input safely.

Closes #50.

Test plan

• Added regression/unit tests and confirmed RED collection failure before implementation (ModuleNotFoundError: No module named 'template_mcp_server.utils.jinja2_security').
• uv run --python 3.12 python -m pytest tests/test_jinja2_security.py -q — 15 passed
• uv run --python 3.12 python -m pytest tests/test_jinja2_security.py tests/test_settings.py tests/test_utils.py -q — 73 passed
• uv run --python 3.12 python -m pytest tests -q — 320 passed, 1 skipped, 1 existing warning
• uv run --python 3.12 ruff check template_mcp_server tests/test_jinja2_security.py tests/test_settings.py — passed
• uv run --python 3.12 python -m py_compile template_mcp_server/utils/jinja2_security.py template_mcp_server/src/settings.py tests/test_jinja2_security.py
• README/.env feature flag assertion script
• git diff --check

[Copilot]

Pull request overview

Adds a Jinja2 safety utility layer to help prevent template-injection when user-controlled text may be interpolated into templates, controlled by a new ENABLE_JINJA2_SECURITY feature flag (default True).

Changes:

• Introduces template_mcp_server.utils.jinja2_security with delimiter escaping, delimiter-based validation, and a helper to build a “secure by default” Jinja2 Environment.
• Adds ENABLE_JINJA2_SECURITY to application settings, plus documentation in README.md and .env.example.
• Adds unit tests covering delimiter escaping, injection detection/logging, env autoescape default behavior, and feature-flag behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/test_jinja2_security.py	Adds unit/regression tests for new Jinja2 security utilities and the feature flag default.
template_mcp_server/utils/jinja2_security.py	Implements delimiter escaping/validation and a helper to create a Jinja2 environment with autoescape enabled by default.
template_mcp_server/src/settings.py	Adds ENABLE_JINJA2_SECURITY setting (default True).
README.md	Documents the new ENABLE_JINJA2_SECURITY environment variable in the config table.
.env.example	Adds ENABLE_JINJA2_SECURITY=True with a short description comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.